Kevin S. Parker, from the 21st Senate District of New York, sponsored Senate Bill S9197 requiring social media and search engine reviews prior to the delivery of a rifle or a shotgun.
My goal for this post is NOT to critique it from an ideological or political view. I want to look at this from a technical and structural perspective. It is bill’s like this that concern me. They do not actually make us safer or protect us from a threat. From both a technical and structural lens, here is why this bill will not increase protection for the average citizen.
From page 2 Line 1 of Senate Bill S9197: “…’SEARCH ENGINE” SHALL ONLY INCLUDE GOOGLE, YAHOO AND BING. UPON COMPLETION OF THE INVESTIGATION, THE POLICE AUTHORITY SHALL REPORT THE RESULTS TO THE PURCHASER WITHOUT UNECESSARY DELAY AND, IF APPROPRIATE, PROVIDE THE PURCHASER WITH PROOF OF APPROVAL TO PURCHASE SUCH RIFLE OR SHOTGUN.”
People DO utilize search engines other than the aforementioned Google, Yahoo, and Bing. For example, DuckDuckGo, is a search engine that is growing in popularity. They do not track your information. Search engines like DuckDuckGo will present issues for supporters of Senate Bill S9197. This bill limits the search of a user’s history to Google, Yahoo, and Bing. These are easy targets and that is why Kevin S. Parker has included only those search engines in his bill. This means that law enforcement do not have the ability to look through other search engines that you may be using. Even if they include DuckDuckGo, this is one of those search engines that doesn’t track or store user information anyway.
The next technical issue lies in the availability of search engine history. Search engine history is not persistent within a computer per se. There are complex mechanisms of communication that are occurring between your computer (usually via web browser) with the search engine that is located on the search engine’s web server. In order to get the search history from your device, they will need physical or remote access to your computer. If you use Incognito Mode on Google Chrome or Private Browsing on Firefox, then traces of your search history will not even be stored locally. Even if you do not use private browsing add-ons, they would still need to conduct a rudimentary forensic analysis of your device. Simply clearing all browsing data or uninstalling your web browser will most likely be enough to throw off the average law enforcement officer. However, if the intent is to conduct a forensic analysis of your device, here is why this will likely not work.
The average law enforcement officer is not trained to conduct digital forensic analysis. This creates a structural issue for local law enforcement agencies. They would need to hire an IT professional or have an IT professional available to conduct the analysis. This costs money. Law enforcement agencies that do have digital forensic capabilities will see workloads increase to unmanageable levels. The next issue would be the acquisition of personal devices to conduct the analysis. Can law enforcement agencies now hold on to your phones, tablets, and computers to conduct the sweep of your devices? How long will you be without your device? If I were the head of a law enforcement agency, the last thing I would want is to be liable for personal devices in mass. Let us assume that law enforcement agencies get the “green light” to conduct this level of forensic analysis. There are means to circumvent this.
First of all, simply destroying your storage devices will halt law enforcement’s ability to conduct digital forensic. If that is too extreme and you still want access to your hard drives, then you can use data shredding software. This is a more sensible approach. With Data Destruction/Data Shredding software, you can ensure that any deleted files on your hard drive are completely unreadable.
If law enforcement agencies cannot get information from your storage devices, they still have one more option. They can request your search history from the various internet companies. For the record, the option I am about to describe was not specified in Senate Bill S9197. This option would also create a different structural dilemma because law enforcement agencies and internet companies will now have to deal with the back log of scouring trillions of files and databases to find the information in question. Although this is within the realm of possibility, it is highly unlikely such an exchange could occur every time the state of New York wanted online search and social media history from a tech company. If they should request the information from Google, Yahoo, or Bing there are many legal methods for them to get a hold of your browser data, but this still creates issues for law enforcement agencies. If you did search or post something that was legally suspect then they will be able to obtain that information legally. However, there are ways to protect yourself or at least make it very difficult to attribute you to specific data that you sent through cyberspace. VPNs and Onion routers render this option unusable if you are careful enough not to leave traces or signatures. Ultimately, if you don’t want to be traced, don’t post on social media or a technology platform with data that can be attributed to you.
Finally, what happens if you simply do not have search or social media history? This is the final structural issue. Although we are connected more than ever before, there are still people out there that do not have social media accounts or a smart phone. What if I dropped my phone in the lake the day before I was supposed to have the search history analysis done? Does this make me exempt? What if I tell law enforcement that I don’t have social media accounts or a device? Is the burden of proof on me or the law enforcement agency to even prove I have a social media account?
Don’t let bill’s like this fool you. They are not keeping you safer. Regardless if you agree with the second amendment or not, let us not pass laws that limit our rights especially if they do not actually serve a real purpose of providing us more safety.
You can read the bill here: New York State Senate Bill S9197